Microsoft-Windows-User-ControlPanel

61 events across 4 channels

Event	Title	Channel	Sample
6001	Initialization_CoreStart	Diagnostic	N
6002	Initialization_CoreStop	Diagnostic	N
6003	Initialization_PageStart	Diagnostic	N
6004	Initialization_PageStop	Diagnostic	N
6005	Settings_UserCreateStart	Diagnostic	N
6006	Settings_UserCreateStop	Diagnostic	N
7001	UserAccount_SettingsPageLoad	Diagnostic	N
7002	UserAccount_UserListRefresh	Diagnostic	N
7003	UserAccount_Taskflow_ConfirmPasswordPage	Diagnostic	N
7004	UserAccount_Taskflow_ConfirmPasswordPage7004	Diagnostic	N
7005	UserAccount_Taskflow_EmailPage	Diagnostic	N
7006	UserAccount_Taskflow_EmailPage7006	Diagnostic	N
7007	UserAccount_Taskflow_FinishPage	Diagnostic	N
7008	UserAccount_Taskflow_FinishPage7008	Diagnostic	N
7009	UserAccount_Taskflow_LocalUserPage	Diagnostic	N
7010	UserAccount_Taskflow_LocalUserPage7010	Diagnostic	N
7011	UserAccount_Taskflow_MoreInfoPage	Diagnostic	N
7012	UserAccount_Taskflow_MoreInfoPage7012	Diagnostic	N
7013	UserAccount_Taskflow_RoamingPage	Diagnostic	N
7014	UserAccount_Taskflow_RoamingPage7014	Diagnostic	N
7015	UserAccount_Taskflow_WebErrorPage	Diagnostic	N
7016	UserAccount_Taskflow_WebErrorPage7016	Diagnostic	N
7017	UserAccount_Taskflow_WebWizardPage	Diagnostic	N
7018	UserAccount_Taskflow_WebWizardPage7018	Diagnostic	N
7019	UserAccount_Taskflow_BitLockerInfoPage	Diagnostic	N
7020	UserAccount_Taskflow_BitLockerInfoPage7020	Diagnostic	N
7021	task_0	Diagnostic	N
7022	task_07022	Diagnostic	N
7023	task_07023	Diagnostic	N
7024	task_07024	Diagnostic	N
7025	task_07025	Diagnostic	N
7026	task_07026	Diagnostic	N
7027	UserAccount_Taskflow_AddChildPage	Diagnostic	N
7028	UserAccount_Taskflow_AddChildPage7028	Diagnostic	N
8001	UserAccount_AddUserWizard_DomainUserAdded	Diagnostic	N
8002	UserAccount_AddUserWizard_ExistingOnlineUserAdded	Diagnostic	N
8003	UserAccount_AddUserWizard_InstallProviderLinkClickedonLocal	Diagnostic	N
8004	UserAccount_AddUserWizard_InstallProviderLinkClickedonOnline	Diagnostic	N
8005	UserAccount_AddUserWizard_LocalUserAdded	Diagnostic	N
8006	UserAccount_AddUserWizard_NewOnlineUserAdded	Diagnostic	N
8007	UserAccount_AddUserWizard_OnlineWizardError	Diagnostic	N
8008	UserAccount_AddUserWizardOpened	Diagnostic	N
8009	UserAccount_ConnectDomainAccount_Completed	Diagnostic	N
8010	UserAccount_ConnectDomainAccount_OnlineWizardError	Diagnostic	N
8011	UserAccount_ConnectDomainAccountOpened	Diagnostic	N
8012	UserAccount_ConnectLocalAccount_Completed	Diagnostic	N
8013	UserAccount_ConnectLocalAccount_OnlineWizardError	Diagnostic	N
8014	UserAccount_ConnectLocalAccountOpened	Diagnostic	N
8015	UserAccount_DisconnectDomainAccount_Completed	Diagnostic	N
8016	UserAccount_DisconnectDomainAccountOpened	Diagnostic	N
8017	UserAccount_DisconnectOnlineAccount_Completed	Diagnostic	N
8018	UserAccount_DisconnectOnlineAccountOpened	Diagnostic	N
8019	UserAccount_AddUserDialogOpened	Diagnostic	N
8020	UserAccount_AddUserDialog_NewOnlineUserAdded	Diagnostic	N
8021	UserAccount_AddUserDialog_ExistingOnlineUserAdded	Diagnostic	N
8022	UserAccount_AddUserDialog_LocalUserAdded	Diagnostic	N
8023	UserAccount_AddUserDialog_OnlineWizardError	Diagnostic	N
9001	Failed execution of [Method].	Operational	N
9002	Failed execution of [Method] for instance = Iteration.	Operational	N
25000	PerfTrack_UAM_TaskFlowPageChangeStart	Diagnostic	N
25001	PerfTrack_UAM_TaskFlowPageChangeStop	Diagnostic	N

Event ID 6001: Initialization_CoreStart

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: Initialization_Core
Opcode: Start

Event ID 6002: Initialization_CoreStop

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: Initialization_Core
Opcode: Stop

Event ID 6003: Initialization_PageStart

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: Initialization_Page
Opcode: Start

Event ID 6004: Initialization_PageStop

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: Initialization_Page
Opcode: Stop

Event ID 6005: Settings_UserCreateStart

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: Settings_UserCreate
Opcode: Start

Event ID 6006: Settings_UserCreateStop

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: Settings_UserCreate
Opcode: Stop

Event ID 7001: UserAccount_SettingsPageLoad

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_SettingsPageLoad

Event ID 7002: UserAccount_UserListRefresh

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_UserListRefresh

Event ID 7003: UserAccount_Taskflow_ConfirmPasswordPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_ConfirmPasswordPage

Event ID 7004: UserAccount_Taskflow_ConfirmPasswordPage7004

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_ConfirmPasswordPage

Event ID 7005: UserAccount_Taskflow_EmailPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_EmailPage

Event ID 7006: UserAccount_Taskflow_EmailPage7006

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_EmailPage

Event ID 7007: UserAccount_Taskflow_FinishPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_FinishPage

Event ID 7008: UserAccount_Taskflow_FinishPage7008

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_FinishPage

Event ID 7009: UserAccount_Taskflow_LocalUserPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_LocalUserPage

Event ID 7010: UserAccount_Taskflow_LocalUserPage7010

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_LocalUserPage

Event ID 7011: UserAccount_Taskflow_MoreInfoPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_MoreInfoPage

Event ID 7012: UserAccount_Taskflow_MoreInfoPage7012

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_MoreInfoPage

Event ID 7013: UserAccount_Taskflow_RoamingPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_RoamingPage

Event ID 7014: UserAccount_Taskflow_RoamingPage7014

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_RoamingPage

Event ID 7015: UserAccount_Taskflow_WebErrorPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_WebErrorPage

Event ID 7016: UserAccount_Taskflow_WebErrorPage7016

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_WebErrorPage

Event ID 7017: UserAccount_Taskflow_WebWizardPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_WebWizardPage

Event ID 7018: UserAccount_Taskflow_WebWizardPage7018

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_WebWizardPage

Event ID 7019: UserAccount_Taskflow_BitLockerInfoPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_BitLockerInfoPage

Event ID 7020: UserAccount_Taskflow_BitLockerInfoPage7020

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_BitLockerInfoPage

Event ID 7021: task_0

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Opcode: Info

Event ID 7022: task_07022

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Opcode: Info

Event ID 7023: task_07023

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Opcode: Info

Event ID 7024: task_07024

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Opcode: Info

Event ID 7025: task_07025

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Opcode: Info

Event ID 7026: task_07026

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Opcode: Info

Event ID 7027: UserAccount_Taskflow_AddChildPage

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_AddChildPage

Event ID 7028: UserAccount_Taskflow_AddChildPage7028

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_Taskflow_AddChildPage

Event ID 8001: UserAccount_AddUserWizard_DomainUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_DomainUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8002: UserAccount_AddUserWizard_ExistingOnlineUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_ExistingOnlineUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8003: UserAccount_AddUserWizard_InstallProviderLinkClickedonLocal

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_InstallProviderLinkClickedonLocal

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8004: UserAccount_AddUserWizard_InstallProviderLinkClickedonOnline

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_InstallProviderLinkClickedonOnline

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8005: UserAccount_AddUserWizard_LocalUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_LocalUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8006: UserAccount_AddUserWizard_NewOnlineUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_NewOnlineUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8007: UserAccount_AddUserWizard_OnlineWizardError

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizard_OnlineWizardError

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8008: UserAccount_AddUserWizardOpened

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserWizardOpened

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8009: UserAccount_ConnectDomainAccount_Completed

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_ConnectDomainAccount_Completed

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8010: UserAccount_ConnectDomainAccount_OnlineWizardError

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_ConnectDomainAccount_OnlineWizardError

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8011: UserAccount_ConnectDomainAccountOpened

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_ConnectDomainAccountOpened

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8012: UserAccount_ConnectLocalAccount_Completed

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_ConnectLocalAccount_Completed

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8013: UserAccount_ConnectLocalAccount_OnlineWizardError

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_ConnectLocalAccount_OnlineWizardError

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8014: UserAccount_ConnectLocalAccountOpened

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_ConnectLocalAccountOpened

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8015: UserAccount_DisconnectDomainAccount_Completed

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_DisconnectDomainAccount_Completed

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8016: UserAccount_DisconnectDomainAccountOpened

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_DisconnectDomainAccountOpened

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8017: UserAccount_DisconnectOnlineAccount_Completed

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_DisconnectOnlineAccount_Completed

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8018: UserAccount_DisconnectOnlineAccountOpened

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_DisconnectOnlineAccountOpened

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8019: UserAccount_AddUserDialogOpened

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserDialogOpened

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8020: UserAccount_AddUserDialog_NewOnlineUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserDialog_NewOnlineUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8021: UserAccount_AddUserDialog_ExistingOnlineUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserDialog_ExistingOnlineUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8022: UserAccount_AddUserDialog_LocalUserAdded

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserDialog_LocalUserAdded

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 8023: UserAccount_AddUserDialog_OnlineWizardError

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: UserAccount_AddUserDialog_OnlineWizardError

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 9001: Failed execution of [Method].

Provider: Microsoft-Windows-User-ControlPanel
Channel: Operational
Opcode: Info

Description

Failed execution of [Method]. (Result HRESULT).

Message #

Failed execution of [%1]. (Result %2)

Fields #

Name	Description
`Method` UnicodeString
`HRESULT` UInt32

Event ID 9002: Failed execution of [Method] for instance = Iteration.

Provider: Microsoft-Windows-User-ControlPanel
Channel: Operational
Opcode: Info

Description

Failed execution of [Method] for instance = Iteration. (Result HRESULT).

Message #

Failed execution of [%1] for instance = %2. (Result %3)

Fields #

Name	Description
`Method` UnicodeString
`Iteration` UInt32
`HRESULT` UInt32

Event ID 25000: PerfTrack_UAM_TaskFlowPageChangeStart

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: PerfTrack_UAM_TaskFlowPageChange
Opcode: Start

Fields #

Name	Description
`TaskFlowID` UInt32
`PageIndex` UInt32

Event ID 25001: PerfTrack_UAM_TaskFlowPageChangeStop

Provider: Microsoft-Windows-User-ControlPanel
Channel: Diagnostic
Task: PerfTrack_UAM_TaskFlowPageChange
Opcode: Stop

Fields #

Name	Description
`TaskFlowID` UInt32
`PageIndex` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 319122a9-1485-4e48-af35-7db2d93b8ad2

Defined in usercpl.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)